Table Creation Commands for Apinizer Logs
The DDL commands on this page use Apinizer's default table names (log_ApiProxyTraffic, log_PolicyCapture, log_AuditEvent, log_Application, log_UnsentMessage, log_TokenTraffic, log_LoginLog) and a schemaless definition.
If you prefer a custom schema or a custom table name, you can configure this under the Usage as Log Target — Table Schema section of the connection definition. You may change the table name in the DDL or add a schema prefix; however, the column names and data types must remain exactly the same — otherwise log records will fail during INSERT with a "column not found" error.
In particular, if you use case-sensitive table names in Oracle (e.g. CREATE TABLE "HR"."logtablosu"), you must enter the table name in double quotes in the connection definition.
See the Database Connection page for details.
Apinizer can store traffic and audit records in relational databases via the DB Connector. The tables below are prepared with the appropriate data types for each supported database type.
Column names are identical across all database types (snake_case). Only the data types differ per database.
API Proxy Traffic Log
This is the main table where all HTTP traffic passing through the API Proxy is recorded.
The CREATE TABLE command below is intended for new installations and already includes all columns — AI Gateway, MCP Gateway, A2A Gateway, routing diagnostics, outbound MCP/A2A call auditing, and policy execution time columns. You do not need to run an additional ALTER.
If you are upgrading an existing installation, do not run this command; your table already exists. Run the ALTER TABLE script of every version you pass through, in order:
- If you are coming from version 2026.04.x: first 2026.09.0 — Log Table ALTER Scripts, then 2026.09.1 — Log Table ALTER Scripts. Since the cumulative 2026.09.0 script already creates the four outbound MCP/A2A audit columns, on the 2026.09.1 page add only the
policy_exec_timescolumn. - If you are coming from version 2026.09.0: only 2026.09.1 — Log Table ALTER Scripts. If your table already has the four outbound MCP/A2A audit columns, add only the
policy_exec_timescolumn — re-adding an existing column raises an error. - Whichever version you are coming from: also run the 2026.09.2 — Log Table ALTER Scripts script once — it adds the client attribution columns, which no earlier script includes.
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
CREATE TABLE log_ApiProxyTraffic (
id VARCHAR2(255) PRIMARY KEY,
log_timestamp TIMESTAMP,
correlation_id VARCHAR2(255),
environment_id VARCHAR2(255),
project_id VARCHAR2(255),
application_id VARCHAR2(255),
application_name VARCHAR2(255),
api_proxy_id VARCHAR2(255),
api_proxy_name VARCHAR2(255),
enum_api_type VARCHAR2(255),
proxy_relative_path VARCHAR2(255),
proxy_method_id VARCHAR2(255),
proxy_method_name VARCHAR2(255),
x_forwarded_for VARCHAR2(255),
username_or_key VARCHAR2(255),
req_context_path VARCHAR2(255),
req_remote_addr VARCHAR2(255),
req_http_method VARCHAR2(255),
req_content_type VARCHAR2(255),
req_path_info VARCHAR2(255),
req_query_string VARCHAR2(255),
req_remote_user VARCHAR2(255),
req_session_id VARCHAR2(255),
req_request_uri VARCHAR2(255),
req_char_encoding VARCHAR2(255),
req_content_length NUMBER(10),
req_protocol VARCHAR2(255),
req_scheme VARCHAR2(255),
req_server_name VARCHAR2(255),
req_server_port NUMBER(10),
req_remote_host VARCHAR2(255),
req_remote_port NUMBER(10),
req_local_name VARCHAR2(255),
req_local_addr VARCHAR2(255),
req_local_port NUMBER(10),
from_client_ro_param CLOB,
from_client_ro_header CLOB,
from_client_ro_body CLOB,
to_backend_param CLOB,
to_backend_header CLOB,
to_backend_body CLOB,
routing_address VARCHAR2(255),
routing_retry_count NUMBER(10),
routing_failover_cnt NUMBER(10),
from_backend_ro_header CLOB,
from_backend_ro_body CLOB,
to_client_header CLOB,
to_client_body CLOB,
time_req_pipeline NUMBER(10),
time_resp_pipeline NUMBER(10),
time_routing_total NUMBER(10),
time_api_proxy_total NUMBER(10),
size_request_total NUMBER(10),
size_response_total NUMBER(10),
cache_hit NUMBER(1),
status_code NUMBER(10),
error_type VARCHAR2(255),
parent_error_type VARCHAR2(255),
result_type VARCHAR2(255),
location_lat NUMBER,
location_lon NUMBER,
is_canary_request NUMBER(1),
canary_routing_status VARCHAR2(255),
mirror_count NUMBER(10),
mirror_success_count NUMBER(10),
mirror_failure_count NUMBER(10),
mirror_total_duration NUMBER(19),
mirror_addresses CLOB,
ai_provider VARCHAR2(64),
ai_model VARCHAR2(128),
ai_token_input NUMBER(19),
ai_token_output NUMBER(19),
ai_token_cached NUMBER(19),
ai_cost_micro NUMBER(19),
ai_first_token_ms NUMBER(19),
ai_tpot_ms NUMBER(19),
ai_total_latency_ms NUMBER(19),
ai_semantic_cache_hit NUMBER(1),
ai_guardrail_hit VARCHAR2(64),
ai_pii_detected NUMBER(1),
ai_finish_reason VARCHAR2(64),
ai_streaming NUMBER(1),
ai_tenant_credential_id VARCHAR2(64),
ai_trace_id VARCHAR2(64),
ai_failover_from VARCHAR2(64),
ai_cost_input_micro NUMBER(19),
ai_cost_output_micro NUMBER(19),
ai_cost_cached_micro NUMBER(19),
mcp_tool_name VARCHAR2(128),
mcp_jsonrpc_id VARCHAR2(64),
ai_deployment_type VARCHAR2(32),
ai_guardrail_total_ms NUMBER(19),
ai_inference_ms NUMBER(19),
ai_overhead_ms NUMBER(19),
routing_failure_reason VARCHAR2(64),
routing_confidence VARCHAR2(16),
routing_exception_class VARCHAR2(255),
routing_exception_detail VARCHAR2(256),
rd_selection_ns NUMBER(19),
rd_dns_ns NUMBER(19),
rd_tcp_connect_ns NUMBER(19),
rd_tls_handshake_ns NUMBER(19),
rd_ttfb_ns NUMBER(19),
rd_body_read_ns NUMBER(19),
rd_pool_wait_ns NUMBER(19),
upstream_status_code NUMBER(5),
upstream_ip_port VARCHAR2(64),
connection_reused NUMBER(1),
ttfb_reached NUMBER(1),
gateway_worker VARCHAR2(128),
pool_leased NUMBER(5),
pool_pending NUMBER(5),
pool_available NUMBER(5),
pool_max NUMBER(5),
cfg_connect_timeout NUMBER(10),
cfg_read_timeout NUMBER(10),
cfg_conn_req_timeout NUMBER(10),
client_write_ms NUMBER(10),
a2a_task_id VARCHAR2(64),
a2a_context_id VARCHAR2(128),
a2a_task_state VARCHAR2(32),
ai_quota_soft_cap_hit NUMBER(10),
ai_quota_alert_hit NUMBER(1),
ai_guardrail_category VARCHAR2(64),
ai_guardrail_verdict VARCHAR2(32),
mcp_tool_names_out VARCHAR2(256),
mcp_tool_call_count_out NUMBER(10),
a2a_skill_names_out VARCHAR2(256),
a2a_agent_call_count_out NUMBER(10),
policy_exec_times VARCHAR2(4000),
api_client_key VARCHAR2(255),
client_owner_type VARCHAR2(16),
client_owner_id VARCHAR2(64),
client_organization_id VARCHAR2(64)
);
CREATE TABLE log_ApiProxyTraffic (
id VARCHAR(255) PRIMARY KEY,
log_timestamp TIMESTAMP NULL,
correlation_id VARCHAR(255),
environment_id VARCHAR(255),
project_id VARCHAR(255),
application_id VARCHAR(255),
application_name VARCHAR(255),
api_proxy_id VARCHAR(255),
api_proxy_name VARCHAR(255),
enum_api_type VARCHAR(255),
proxy_relative_path VARCHAR(255),
proxy_method_id VARCHAR(255),
proxy_method_name VARCHAR(255),
x_forwarded_for VARCHAR(255),
username_or_key VARCHAR(255),
req_context_path VARCHAR(255),
req_remote_addr VARCHAR(255),
req_http_method VARCHAR(255),
req_content_type VARCHAR(255),
req_path_info VARCHAR(255),
req_query_string VARCHAR(255),
req_remote_user VARCHAR(255),
req_session_id VARCHAR(255),
req_request_uri VARCHAR(255),
req_char_encoding VARCHAR(255),
req_content_length INT,
req_protocol VARCHAR(255),
req_scheme VARCHAR(255),
req_server_name VARCHAR(255),
req_server_port INT,
req_remote_host VARCHAR(255),
req_remote_port INT,
req_local_name VARCHAR(255),
req_local_addr VARCHAR(255),
req_local_port INT,
from_client_ro_param TEXT,
from_client_ro_header TEXT,
from_client_ro_body LONGTEXT,
to_backend_param TEXT,
to_backend_header TEXT,
to_backend_body LONGTEXT,
routing_address VARCHAR(255),
routing_retry_count INT,
routing_failover_cnt INT,
from_backend_ro_header TEXT,
from_backend_ro_body LONGTEXT,
to_client_header TEXT,
to_client_body LONGTEXT,
time_req_pipeline INT,
time_resp_pipeline INT,
time_routing_total INT,
time_api_proxy_total INT,
size_request_total INT,
size_response_total INT,
cache_hit BOOLEAN,
status_code INT,
error_type VARCHAR(255),
parent_error_type VARCHAR(255),
result_type VARCHAR(255),
location_lat DOUBLE,
location_lon DOUBLE,
is_canary_request BOOLEAN,
canary_routing_status VARCHAR(255),
mirror_count INT,
mirror_success_count INT,
mirror_failure_count INT,
mirror_total_duration BIGINT,
mirror_addresses TEXT,
ai_provider VARCHAR(64),
ai_model VARCHAR(128),
ai_token_input BIGINT,
ai_token_output BIGINT,
ai_token_cached BIGINT,
ai_cost_micro BIGINT,
ai_first_token_ms BIGINT,
ai_tpot_ms BIGINT,
ai_total_latency_ms BIGINT,
ai_semantic_cache_hit BOOLEAN,
ai_guardrail_hit VARCHAR(64),
ai_pii_detected BOOLEAN,
ai_finish_reason VARCHAR(64),
ai_streaming BOOLEAN,
ai_tenant_credential_id VARCHAR(64),
ai_trace_id VARCHAR(64),
ai_failover_from VARCHAR(64),
ai_cost_input_micro BIGINT,
ai_cost_output_micro BIGINT,
ai_cost_cached_micro BIGINT,
mcp_tool_name VARCHAR(128),
mcp_jsonrpc_id VARCHAR(64),
ai_deployment_type VARCHAR(32),
ai_guardrail_total_ms BIGINT,
ai_inference_ms BIGINT,
ai_overhead_ms BIGINT,
routing_failure_reason VARCHAR(64),
routing_confidence VARCHAR(16),
routing_exception_class VARCHAR(255),
routing_exception_detail VARCHAR(256),
rd_selection_ns BIGINT,
rd_dns_ns BIGINT,
rd_tcp_connect_ns BIGINT,
rd_tls_handshake_ns BIGINT,
rd_ttfb_ns BIGINT,
rd_body_read_ns BIGINT,
rd_pool_wait_ns BIGINT,
upstream_status_code SMALLINT,
upstream_ip_port VARCHAR(64),
connection_reused BOOLEAN,
ttfb_reached BOOLEAN,
gateway_worker VARCHAR(128),
pool_leased SMALLINT,
pool_pending SMALLINT,
pool_available SMALLINT,
pool_max SMALLINT,
cfg_connect_timeout INT,
cfg_read_timeout INT,
cfg_conn_req_timeout INT,
client_write_ms INT,
a2a_task_id VARCHAR(64),
a2a_context_id VARCHAR(128),
a2a_task_state VARCHAR(32),
ai_quota_soft_cap_hit INT,
ai_quota_alert_hit BOOLEAN,
ai_guardrail_category VARCHAR(64),
ai_guardrail_verdict VARCHAR(32),
mcp_tool_names_out VARCHAR(256),
mcp_tool_call_count_out INT,
a2a_skill_names_out VARCHAR(256),
a2a_agent_call_count_out INT,
policy_exec_times VARCHAR(4000),
api_client_key VARCHAR(255),
client_owner_type VARCHAR(16),
client_owner_id VARCHAR(64),
client_organization_id VARCHAR(64)
);
CREATE TABLE log_ApiProxyTraffic (
id VARCHAR(255) PRIMARY KEY,
log_timestamp TIMESTAMP,
correlation_id VARCHAR(255),
environment_id VARCHAR(255),
project_id VARCHAR(255),
application_id VARCHAR(255),
application_name VARCHAR(255),
api_proxy_id VARCHAR(255),
api_proxy_name VARCHAR(255),
enum_api_type VARCHAR(255),
proxy_relative_path VARCHAR(255),
proxy_method_id VARCHAR(255),
proxy_method_name VARCHAR(255),
x_forwarded_for VARCHAR(255),
username_or_key VARCHAR(255),
req_context_path VARCHAR(255),
req_remote_addr VARCHAR(255),
req_http_method VARCHAR(255),
req_content_type VARCHAR(255),
req_path_info VARCHAR(255),
req_query_string VARCHAR(255),
req_remote_user VARCHAR(255),
req_session_id VARCHAR(255),
req_request_uri VARCHAR(255),
req_char_encoding VARCHAR(255),
req_content_length INTEGER,
req_protocol VARCHAR(255),
req_scheme VARCHAR(255),
req_server_name VARCHAR(255),
req_server_port INTEGER,
req_remote_host VARCHAR(255),
req_remote_port INTEGER,
req_local_name VARCHAR(255),
req_local_addr VARCHAR(255),
req_local_port INTEGER,
from_client_ro_param TEXT,
from_client_ro_header TEXT,
from_client_ro_body TEXT,
to_backend_param TEXT,
to_backend_header TEXT,
to_backend_body TEXT,
routing_address VARCHAR(255),
routing_retry_count INTEGER,
routing_failover_cnt INTEGER,
from_backend_ro_header TEXT,
from_backend_ro_body TEXT,
to_client_header TEXT,
to_client_body TEXT,
time_req_pipeline INTEGER,
time_resp_pipeline INTEGER,
time_routing_total INTEGER,
time_api_proxy_total INTEGER,
size_request_total INTEGER,
size_response_total INTEGER,
cache_hit BOOLEAN,
status_code INTEGER,
error_type VARCHAR(255),
parent_error_type VARCHAR(255),
result_type VARCHAR(255),
location_lat DOUBLE PRECISION,
location_lon DOUBLE PRECISION,
is_canary_request BOOLEAN,
canary_routing_status VARCHAR(255),
mirror_count INTEGER,
mirror_success_count INTEGER,
mirror_failure_count INTEGER,
mirror_total_duration BIGINT,
mirror_addresses TEXT,
ai_provider VARCHAR(64),
ai_model VARCHAR(128),
ai_token_input BIGINT,
ai_token_output BIGINT,
ai_token_cached BIGINT,
ai_cost_micro BIGINT,
ai_first_token_ms BIGINT,
ai_tpot_ms BIGINT,
ai_total_latency_ms BIGINT,
ai_semantic_cache_hit BOOLEAN,
ai_guardrail_hit VARCHAR(64),
ai_pii_detected BOOLEAN,
ai_finish_reason VARCHAR(64),
ai_streaming BOOLEAN,
ai_tenant_credential_id VARCHAR(64),
ai_trace_id VARCHAR(64),
ai_failover_from VARCHAR(64),
ai_cost_input_micro BIGINT,
ai_cost_output_micro BIGINT,
ai_cost_cached_micro BIGINT,
mcp_tool_name VARCHAR(128),
mcp_jsonrpc_id VARCHAR(64),
ai_deployment_type VARCHAR(32),
ai_guardrail_total_ms BIGINT,
ai_inference_ms BIGINT,
ai_overhead_ms BIGINT,
routing_failure_reason VARCHAR(64),
routing_confidence VARCHAR(16),
routing_exception_class VARCHAR(255),
routing_exception_detail VARCHAR(256),
rd_selection_ns BIGINT,
rd_dns_ns BIGINT,
rd_tcp_connect_ns BIGINT,
rd_tls_handshake_ns BIGINT,
rd_ttfb_ns BIGINT,
rd_body_read_ns BIGINT,
rd_pool_wait_ns BIGINT,
upstream_status_code SMALLINT,
upstream_ip_port VARCHAR(64),
connection_reused BOOLEAN,
ttfb_reached BOOLEAN,
gateway_worker VARCHAR(128),
pool_leased SMALLINT,
pool_pending SMALLINT,
pool_available SMALLINT,
pool_max SMALLINT,
cfg_connect_timeout INTEGER,
cfg_read_timeout INTEGER,
cfg_conn_req_timeout INTEGER,
client_write_ms INTEGER,
a2a_task_id VARCHAR(64),
a2a_context_id VARCHAR(128),
a2a_task_state VARCHAR(32),
ai_quota_soft_cap_hit INTEGER,
ai_quota_alert_hit BOOLEAN,
ai_guardrail_category VARCHAR(64),
ai_guardrail_verdict VARCHAR(32),
mcp_tool_names_out VARCHAR(256),
mcp_tool_call_count_out INTEGER,
a2a_skill_names_out VARCHAR(256),
a2a_agent_call_count_out INTEGER,
policy_exec_times VARCHAR(4000),
api_client_key VARCHAR(255),
client_owner_type VARCHAR(16),
client_owner_id VARCHAR(64),
client_organization_id VARCHAR(64)
);
CREATE TABLE log_ApiProxyTraffic (
id NVARCHAR(255) PRIMARY KEY,
log_timestamp DATETIME2,
correlation_id NVARCHAR(255),
environment_id NVARCHAR(255),
project_id NVARCHAR(255),
application_id NVARCHAR(255),
application_name NVARCHAR(255),
api_proxy_id NVARCHAR(255),
api_proxy_name NVARCHAR(255),
enum_api_type NVARCHAR(255),
proxy_relative_path NVARCHAR(255),
proxy_method_id NVARCHAR(255),
proxy_method_name NVARCHAR(255),
x_forwarded_for NVARCHAR(255),
username_or_key NVARCHAR(255),
req_context_path NVARCHAR(255),
req_remote_addr NVARCHAR(255),
req_http_method NVARCHAR(255),
req_content_type NVARCHAR(255),
req_path_info NVARCHAR(255),
req_query_string NVARCHAR(255),
req_remote_user NVARCHAR(255),
req_session_id NVARCHAR(255),
req_request_uri NVARCHAR(255),
req_char_encoding NVARCHAR(255),
req_content_length INT,
req_protocol NVARCHAR(255),
req_scheme NVARCHAR(255),
req_server_name NVARCHAR(255),
req_server_port INT,
req_remote_host NVARCHAR(255),
req_remote_port INT,
req_local_name NVARCHAR(255),
req_local_addr NVARCHAR(255),
req_local_port INT,
from_client_ro_param NVARCHAR(MAX),
from_client_ro_header NVARCHAR(MAX),
from_client_ro_body NVARCHAR(MAX),
to_backend_param NVARCHAR(MAX),
to_backend_header NVARCHAR(MAX),
to_backend_body NVARCHAR(MAX),
routing_address NVARCHAR(255),
routing_retry_count INT,
routing_failover_cnt INT,
from_backend_ro_header NVARCHAR(MAX),
from_backend_ro_body NVARCHAR(MAX),
to_client_header NVARCHAR(MAX),
to_client_body NVARCHAR(MAX),
time_req_pipeline INT,
time_resp_pipeline INT,
time_routing_total INT,
time_api_proxy_total INT,
size_request_total INT,
size_response_total INT,
cache_hit BIT,
status_code INT,
error_type NVARCHAR(255),
parent_error_type NVARCHAR(255),
result_type NVARCHAR(255),
location_lat FLOAT,
location_lon FLOAT,
is_canary_request BIT,
canary_routing_status NVARCHAR(255),
mirror_count INT,
mirror_success_count INT,
mirror_failure_count INT,
mirror_total_duration BIGINT,
mirror_addresses NVARCHAR(MAX),
ai_provider NVARCHAR(64),
ai_model NVARCHAR(128),
ai_token_input BIGINT,
ai_token_output BIGINT,
ai_token_cached BIGINT,
ai_cost_micro BIGINT,
ai_first_token_ms BIGINT,
ai_tpot_ms BIGINT,
ai_total_latency_ms BIGINT,
ai_semantic_cache_hit BIT,
ai_guardrail_hit NVARCHAR(64),
ai_pii_detected BIT,
ai_finish_reason NVARCHAR(64),
ai_streaming BIT,
ai_tenant_credential_id NVARCHAR(64),
ai_trace_id NVARCHAR(64),
ai_failover_from NVARCHAR(64),
ai_cost_input_micro BIGINT,
ai_cost_output_micro BIGINT,
ai_cost_cached_micro BIGINT,
mcp_tool_name NVARCHAR(128),
mcp_jsonrpc_id NVARCHAR(64),
ai_deployment_type NVARCHAR(32),
ai_guardrail_total_ms BIGINT,
ai_inference_ms BIGINT,
ai_overhead_ms BIGINT,
routing_failure_reason NVARCHAR(64),
routing_confidence NVARCHAR(16),
routing_exception_class NVARCHAR(255),
routing_exception_detail NVARCHAR(256),
rd_selection_ns BIGINT,
rd_dns_ns BIGINT,
rd_tcp_connect_ns BIGINT,
rd_tls_handshake_ns BIGINT,
rd_ttfb_ns BIGINT,
rd_body_read_ns BIGINT,
rd_pool_wait_ns BIGINT,
upstream_status_code SMALLINT,
upstream_ip_port NVARCHAR(64),
connection_reused BIT,
ttfb_reached BIT,
gateway_worker NVARCHAR(128),
pool_leased SMALLINT,
pool_pending SMALLINT,
pool_available SMALLINT,
pool_max SMALLINT,
cfg_connect_timeout INT,
cfg_read_timeout INT,
cfg_conn_req_timeout INT,
client_write_ms INT,
a2a_task_id NVARCHAR(64),
a2a_context_id NVARCHAR(128),
a2a_task_state NVARCHAR(32),
ai_quota_soft_cap_hit INT,
ai_quota_alert_hit BIT,
ai_guardrail_category NVARCHAR(64),
ai_guardrail_verdict NVARCHAR(32),
mcp_tool_names_out NVARCHAR(256),
mcp_tool_call_count_out INT,
a2a_skill_names_out NVARCHAR(256),
a2a_agent_call_count_out INT,
policy_exec_times NVARCHAR(4000),
api_client_key NVARCHAR(255),
client_owner_type NVARCHAR(16),
client_owner_id NVARCHAR(64),
client_organization_id NVARCHAR(64)
);
When creating this table, SQL Server issues the following warning: "the table has been created, but its maximum row size exceeds the allowed maximum of 8060 bytes". This is expected and is not an error.
The total declared width of the variable-length NVARCHAR columns in the table exceeds the 8060-byte in-row limit per row; since SQL Server 2005 these columns are automatically moved to ROW_OVERFLOW_DATA pages when needed, leaving a 24-byte pointer in the row. Because the total of the fixed-length columns (~287 bytes) is well below the limit, INSERT operations do not fail. The only effect is the additional page read/write cost on rows where many long text fields are populated at the same time.
Narrowing the column widths enough to silence this warning (all text columns to 64 characters) was not preferred, as it would cause data loss in fields such as req_request_uri, req_query_string and application_name.
| Column | Description |
|---|---|
| id | Record identifier |
| log_timestamp | Time the log record was created |
| correlation_id | Request-specific correlation identifier; links records belonging to the same request chain |
| environment_id | Identifier of the environment in which the request was processed |
| project_id | Identifier of the project the API belongs to |
| application_id | Identifier of the application making the request |
| application_name | Name of the application making the request |
| api_proxy_id | Identifier of the API Proxy used for the request |
| api_proxy_name | Name of the API Proxy used for the request |
| enum_api_type | API type (REST, SOAP, etc.) |
| proxy_relative_path | API Proxy relative path |
| proxy_method_id | Identifier of the matched method |
| proxy_method_name | Name of the matched method |
| x_forwarded_for | The client's real IP address (proxy/load balancer chain) |
| username_or_key | Username or API key used in authentication |
| req_context_path | Request context path |
| req_remote_addr | Remote address |
| req_http_method | HTTP method (GET, POST, PUT, etc.) |
| req_content_type | Content type of the request |
| req_path_info | Request path info |
| req_query_string | Request query string |
| req_remote_user | Remote user |
| req_session_id | Session identifier |
| req_request_uri | Request URI |
| req_char_encoding | Request character encoding |
| req_content_length | Request content length (bytes) |
| req_protocol | Protocol |
| req_scheme | Scheme (http/https) |
| req_server_name | Server name |
| req_server_port | Server port |
| req_remote_host | Remote host |
| req_remote_port | Remote port |
| req_local_name | Local name |
| req_local_addr | Local address |
| req_local_port | Local port |
| from_client_ro_param | Query parameters received from the client (JSON) |
| from_client_ro_header | Headers received from the client (JSON) |
| from_client_ro_body | Request body received from the client |
| to_backend_param | Query parameters sent to the backend (JSON) |
| to_backend_header | Headers sent to the backend (JSON) |
| to_backend_body | Request body sent to the backend |
| routing_address | Backend address the request was routed to |
| routing_retry_count | Number of retries |
| routing_failover_cnt | Number of failovers |
| from_backend_ro_header | Response headers received from the backend (JSON) |
| from_backend_ro_body | Response body received from the backend |
| to_client_header | Response headers sent to the client (JSON) |
| to_client_body | Response body sent to the client |
| time_req_pipeline | Request pipeline duration (ms) |
| time_resp_pipeline | Response pipeline duration (ms) |
| time_routing_total | Total routing duration (ms) |
| time_api_proxy_total | Total API Proxy processing time (ms) |
| size_request_total | Request size (bytes) |
| size_response_total | Response size (bytes) |
| cache_hit | Whether the response was served from cache |
| status_code | HTTP response code |
| error_type | Error type |
| parent_error_type | Parent error type |
| result_type | Operation result |
| location_lat | Geographic location — latitude |
| location_lon | Geographic location — longitude |
| is_canary_request | Whether this is a canary routing request |
| canary_routing_status | Canary routing status |
| mirror_count | Number of mirrors |
| mirror_success_count | Number of successful mirrors |
| mirror_failure_count | Number of failed mirrors |
| mirror_total_duration | Total mirroring duration (ms) |
| mirror_addresses | Mirror addresses (JSON) |
| mcp_tool_names_out | Distinct MCP tool names called in outbound requests (CSV, limited to 256 characters) |
| mcp_tool_call_count_out | Total number of outbound MCP tool calls (raw, unlimited) |
| a2a_skill_names_out | Distinct A2A skill/agent names called in outbound requests (CSV, limited to 256 characters) |
| a2a_agent_call_count_out | Total number of outbound A2A agent calls (raw, unlimited) |
| policy_exec_times | Policy execution times — order:type:duration CSV; written only when the setting is enabled on the log target |
| api_client_key | API Client key that authenticated the request (empty when the identity was authenticated without an API Client) |
| client_owner_type | Kind of subject the API Client belongs to — CONSUMER or APPLICATION |
| client_owner_id | Id of the owning Consumer (Credential) or Portal Application |
| client_organization_id | Organization id of the authenticated identity |
Recommended Indexes
This is the highest-volume log table. The indexes below cover the most frequently used query patterns (end-to-end tracing, time range scans, proxy/project-based filtering, error analysis).
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
CREATE INDEX idx_apitraffic_correlation ON log_ApiProxyTraffic(correlation_id);
CREATE INDEX idx_apitraffic_timestamp ON log_ApiProxyTraffic(log_timestamp);
CREATE INDEX idx_apitraffic_proxy ON log_ApiProxyTraffic(api_proxy_id);
CREATE INDEX idx_apitraffic_project ON log_ApiProxyTraffic(project_id);
CREATE INDEX idx_apitraffic_status ON log_ApiProxyTraffic(status_code);
CREATE INDEX idx_apitraffic_result ON log_ApiProxyTraffic(result_type);
CREATE INDEX idx_apitraffic_correlation ON log_ApiProxyTraffic(correlation_id);
CREATE INDEX idx_apitraffic_timestamp ON log_ApiProxyTraffic(log_timestamp);
CREATE INDEX idx_apitraffic_proxy ON log_ApiProxyTraffic(api_proxy_id);
CREATE INDEX idx_apitraffic_project ON log_ApiProxyTraffic(project_id);
CREATE INDEX idx_apitraffic_status ON log_ApiProxyTraffic(status_code);
CREATE INDEX idx_apitraffic_result ON log_ApiProxyTraffic(result_type);
CREATE INDEX idx_apitraffic_correlation ON log_ApiProxyTraffic(correlation_id);
CREATE INDEX idx_apitraffic_timestamp ON log_ApiProxyTraffic(log_timestamp);
CREATE INDEX idx_apitraffic_proxy ON log_ApiProxyTraffic(api_proxy_id);
CREATE INDEX idx_apitraffic_project ON log_ApiProxyTraffic(project_id);
CREATE INDEX idx_apitraffic_status ON log_ApiProxyTraffic(status_code);
CREATE INDEX idx_apitraffic_result ON log_ApiProxyTraffic(result_type);
-- Without partitioning:
CREATE INDEX idx_apitraffic_correlation ON log_ApiProxyTraffic(correlation_id);
CREATE INDEX idx_apitraffic_timestamp ON log_ApiProxyTraffic(log_timestamp);
CREATE INDEX idx_apitraffic_proxy ON log_ApiProxyTraffic(api_proxy_id);
CREATE INDEX idx_apitraffic_project ON log_ApiProxyTraffic(project_id);
CREATE INDEX idx_apitraffic_status ON log_ApiProxyTraffic(status_code);
CREATE INDEX idx_apitraffic_result ON log_ApiProxyTraffic(result_type);
-- If a partition scheme is used (e.g. ps_logs_daily), idx_apitraffic_timestamp is unnecessary —
-- the clustered index on log_timestamp already covers it. Align the other indexes:
-- CREATE INDEX idx_apitraffic_correlation ON log_ApiProxyTraffic(correlation_id)
-- ON ps_logs_daily(log_timestamp);
-- CREATE INDEX idx_apitraffic_proxy ON log_ApiProxyTraffic(api_proxy_id)
-- ON ps_logs_daily(log_timestamp);
-- ... (same pattern for project, status, result)
Partitioning
This table grows very quickly under live traffic. Applying daily partitioning on log_timestamp is strongly recommended. This way the retention policy can be applied with DROP PARTITION, and time range queries scan only the relevant partitions. For database-specific examples, see the Partition Syntax section.
Token Traffic Log
This is the table where OAuth/JWT token operations are recorded.
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
CREATE TABLE log_TokenTraffic (
id VARCHAR2(255) PRIMARY KEY,
log_timestamp TIMESTAMP,
correlation_id VARCHAR2(255),
environment_id VARCHAR2(255),
project_id VARCHAR2(255),
application_id VARCHAR2(255),
application_name VARCHAR2(255),
api_proxy_id VARCHAR2(255),
api_proxy_name VARCHAR2(255),
x_forwarded_for VARCHAR2(255),
req_remote_addr VARCHAR2(255),
req_http_method VARCHAR2(255),
req_content_type VARCHAR2(255),
username_or_key VARCHAR2(255),
time_total NUMBER(10),
status_code NUMBER(10),
error_type VARCHAR2(255),
parent_error_type VARCHAR2(255),
result_type VARCHAR2(255),
to_client_header CLOB,
to_client_body CLOB,
auth_token_type VARCHAR2(255),
audience VARCHAR2(255),
client_info VARCHAR2(255),
token_never_expires NUMBER(1),
issued_at TIMESTAMP,
expires_at TIMESTAMP,
expires_in NUMBER(10),
scope VARCHAR2(255),
refresh_token_allowed NUMBER(1),
refresh_token_issued_at TIMESTAMP,
refresh_token_expires_at TIMESTAMP,
refresh_token_expires_in NUMBER(10),
refresh_count NUMBER(10),
max_refresh_count NUMBER(10),
api_client_key VARCHAR2(255),
client_organization_id VARCHAR2(64)
);
CREATE TABLE log_TokenTraffic (
id VARCHAR(255) PRIMARY KEY,
log_timestamp TIMESTAMP NULL,
correlation_id VARCHAR(255),
environment_id VARCHAR(255),
project_id VARCHAR(255),
application_id VARCHAR(255),
application_name VARCHAR(255),
api_proxy_id VARCHAR(255),
api_proxy_name VARCHAR(255),
x_forwarded_for VARCHAR(255),
req_remote_addr VARCHAR(255),
req_http_method VARCHAR(255),
req_content_type VARCHAR(255),
username_or_key VARCHAR(255),
time_total INT,
status_code INT,
error_type VARCHAR(255),
parent_error_type VARCHAR(255),
result_type VARCHAR(255),
to_client_header TEXT,
to_client_body TEXT,
auth_token_type VARCHAR(255),
audience VARCHAR(255),
client_info VARCHAR(255),
token_never_expires TINYINT(1),
issued_at TIMESTAMP NULL,
expires_at TIMESTAMP NULL,
expires_in INT,
scope VARCHAR(255),
refresh_token_allowed TINYINT(1),
refresh_token_issued_at TIMESTAMP NULL,
refresh_token_expires_at TIMESTAMP NULL,
refresh_token_expires_in INT,
refresh_count INT,
max_refresh_count INT,
api_client_key VARCHAR(255),
client_organization_id VARCHAR(64)
);
CREATE TABLE log_TokenTraffic (
id VARCHAR(255) PRIMARY KEY,
log_timestamp TIMESTAMP,
correlation_id VARCHAR(255),
environment_id VARCHAR(255),
project_id VARCHAR(255),
application_id VARCHAR(255),
application_name VARCHAR(255),
api_proxy_id VARCHAR(255),
api_proxy_name VARCHAR(255),
x_forwarded_for VARCHAR(255),
req_remote_addr VARCHAR(255),
req_http_method VARCHAR(255),
req_content_type VARCHAR(255),
username_or_key VARCHAR(255),
time_total INTEGER,
status_code INTEGER,
error_type VARCHAR(255),
parent_error_type VARCHAR(255),
result_type VARCHAR(255),
to_client_header TEXT,
to_client_body TEXT,
auth_token_type VARCHAR(255),
audience VARCHAR(255),
client_info VARCHAR(255),
token_never_expires BOOLEAN,
issued_at TIMESTAMP,
expires_at TIMESTAMP,
expires_in INTEGER,
scope VARCHAR(255),
refresh_token_allowed BOOLEAN,
refresh_token_issued_at TIMESTAMP,
refresh_token_expires_at TIMESTAMP,
refresh_token_expires_in INTEGER,
refresh_count INTEGER,
max_refresh_count INTEGER,
api_client_key VARCHAR(255),
client_organization_id VARCHAR(64)
);
CREATE TABLE log_TokenTraffic (
id NVARCHAR(255) PRIMARY KEY,
log_timestamp DATETIME2,
correlation_id NVARCHAR(255),
environment_id NVARCHAR(255),
project_id NVARCHAR(255),
application_id NVARCHAR(255),
application_name NVARCHAR(255),
api_proxy_id NVARCHAR(255),
api_proxy_name NVARCHAR(255),
x_forwarded_for NVARCHAR(255),
req_remote_addr NVARCHAR(255),
req_http_method NVARCHAR(255),
req_content_type NVARCHAR(255),
username_or_key NVARCHAR(255),
time_total INT,
status_code INT,
error_type NVARCHAR(255),
parent_error_type NVARCHAR(255),
result_type NVARCHAR(255),
to_client_header NVARCHAR(MAX),
to_client_body NVARCHAR(MAX),
auth_token_type NVARCHAR(255),
audience NVARCHAR(255),
client_info NVARCHAR(255),
token_never_expires BIT,
issued_at DATETIME2,
expires_at DATETIME2,
expires_in INT,
scope NVARCHAR(255),
refresh_token_allowed BIT,
refresh_token_issued_at DATETIME2,
refresh_token_expires_at DATETIME2,
refresh_token_expires_in INT,
refresh_count INT,
max_refresh_count INT,
api_client_key NVARCHAR(255),
client_organization_id NVARCHAR(64)
);
| Column | Description |
|---|---|
| id | Record identifier |
| log_timestamp | Time the log record was created |
| correlation_id | Correlation identifier |
| environment_id | Environment identifier |
| project_id | Project identifier |
| application_id | Application identifier |
| application_name | Application name |
| api_proxy_id | API Proxy identifier |
| api_proxy_name | API Proxy name |
| x_forwarded_for | The client's real IP address |
| req_remote_addr | Remote address |
| req_http_method | HTTP method |
| req_content_type | Content type of the request |
| username_or_key | Username or API key |
| time_total | Total processing time (ms) |
| status_code | HTTP response code |
| error_type | Error type |
| parent_error_type | Parent error type |
| result_type | Operation result |
| to_client_header | Headers sent to the client (JSON) |
| to_client_body | Response body sent to the client |
| auth_token_type | Token type (Bearer, Basic, etc.) |
| audience | Intended audience of the token |
| client_info | Client information |
| token_never_expires | Whether the token ever expires |
| issued_at | Time the token was issued |
| expires_at | Token expiry time |
| expires_in | Token validity period (seconds) |
| scope | Scope information of the token |
| refresh_token_allowed | Whether a refresh token is allowed |
| refresh_token_issued_at | Time the refresh token was issued |
| refresh_token_expires_at | Refresh token expiry time |
| refresh_token_expires_in | Refresh token validity period (seconds) |
| refresh_count | Number of refreshes |
| max_refresh_count | Maximum number of refreshes allowed |
| api_client_key | API Client key the token was issued to |
| client_organization_id | Organization id of the identity the token was issued to |
Recommended Indexes
Token operations are frequently examined by user/application and time range. When tracing an end-to-end call, joining with the API traffic table on correlation_id is also common.
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
CREATE INDEX idx_tokentraffic_correlation ON log_TokenTraffic(correlation_id);
CREATE INDEX idx_tokentraffic_timestamp ON log_TokenTraffic(log_timestamp);
CREATE INDEX idx_tokentraffic_proxy ON log_TokenTraffic(api_proxy_id);
CREATE INDEX idx_tokentraffic_user ON log_TokenTraffic(username_or_key);
CREATE INDEX idx_tokentraffic_result ON log_TokenTraffic(result_type);
CREATE INDEX idx_tokentraffic_correlation ON log_TokenTraffic(correlation_id);
CREATE INDEX idx_tokentraffic_timestamp ON log_TokenTraffic(log_timestamp);
CREATE INDEX idx_tokentraffic_proxy ON log_TokenTraffic(api_proxy_id);
CREATE INDEX idx_tokentraffic_user ON log_TokenTraffic(username_or_key);
CREATE INDEX idx_tokentraffic_result ON log_TokenTraffic(result_type);
CREATE INDEX idx_tokentraffic_correlation ON log_TokenTraffic(correlation_id);
CREATE INDEX idx_tokentraffic_timestamp ON log_TokenTraffic(log_timestamp);
CREATE INDEX idx_tokentraffic_proxy ON log_TokenTraffic(api_proxy_id);
CREATE INDEX idx_tokentraffic_user ON log_TokenTraffic(username_or_key);
CREATE INDEX idx_tokentraffic_result ON log_TokenTraffic(result_type);
CREATE INDEX idx_tokentraffic_correlation ON log_TokenTraffic(correlation_id);
CREATE INDEX idx_tokentraffic_timestamp ON log_TokenTraffic(log_timestamp);
CREATE INDEX idx_tokentraffic_proxy ON log_TokenTraffic(api_proxy_id);
CREATE INDEX idx_tokentraffic_user ON log_TokenTraffic(username_or_key);
CREATE INDEX idx_tokentraffic_result ON log_TokenTraffic(result_type);
Partitioning
Token volume generally grows in proportion to API traffic volume. Daily partitioning on log_timestamp is recommended. See Partition Syntax.
Log Policy
This is the table that stores the message snapshot captured each time the Log Policy is triggered.
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
CREATE TABLE log_PolicyCapture (
id VARCHAR2(255) PRIMARY KEY,
log_timestamp TIMESTAMP,
correlation_id VARCHAR2(255),
environment_id VARCHAR2(255),
api_proxy_id VARCHAR2(255),
api_proxy_name VARCHAR2(255),
proxy_method_id VARCHAR2(255),
proxy_method_name VARCHAR2(255),
username_or_key VARCHAR2(255),
status_code NUMBER(10),
result_type VARCHAR2(255),
error_type VARCHAR2(255),
from_client_ro_header CLOB,
from_client_ro_param CLOB,
from_client_ro_body CLOB,
capture_region VARCHAR2(50),
capture_location VARCHAR2(50)
);
CREATE TABLE log_PolicyCapture (
id VARCHAR(255) PRIMARY KEY,
log_timestamp TIMESTAMP NULL,
correlation_id VARCHAR(255),
environment_id VARCHAR(255),
api_proxy_id VARCHAR(255),
api_proxy_name VARCHAR(255),
proxy_method_id VARCHAR(255),
proxy_method_name VARCHAR(255),
username_or_key VARCHAR(255),
status_code INT,
result_type VARCHAR(255),
error_type VARCHAR(255),
from_client_ro_header TEXT,
from_client_ro_param TEXT,
from_client_ro_body LONGTEXT,
capture_region VARCHAR(50),
capture_location VARCHAR(50)
);
CREATE TABLE log_PolicyCapture (
id VARCHAR(255) PRIMARY KEY,
log_timestamp TIMESTAMP,
correlation_id VARCHAR(255),
environment_id VARCHAR(255),
api_proxy_id VARCHAR(255),
api_proxy_name VARCHAR(255),
proxy_method_id VARCHAR(255),
proxy_method_name VARCHAR(255),
username_or_key VARCHAR(255),
status_code INTEGER,
result_type VARCHAR(255),
error_type VARCHAR(255),
from_client_ro_header TEXT,
from_client_ro_param TEXT,
from_client_ro_body TEXT,
capture_region VARCHAR(50),
capture_location VARCHAR(50)
);
CREATE TABLE log_PolicyCapture (
id NVARCHAR(255) PRIMARY KEY,
log_timestamp DATETIME2,
correlation_id NVARCHAR(255),
environment_id NVARCHAR(255),
api_proxy_id NVARCHAR(255),
api_proxy_name NVARCHAR(255),
proxy_method_id NVARCHAR(255),
proxy_method_name NVARCHAR(255),
username_or_key NVARCHAR(255),
status_code INT,
result_type NVARCHAR(255),
error_type NVARCHAR(255),
from_client_ro_header NVARCHAR(MAX),
from_client_ro_param NVARCHAR(MAX),
from_client_ro_body NVARCHAR(MAX),
capture_region NVARCHAR(50),
capture_location NVARCHAR(50)
);
| Column | Description |
|---|---|
| id | Record identifier |
| log_timestamp | Time the log record was created |
| correlation_id | Correlation identifier |
| environment_id | Environment identifier |
| api_proxy_id | API Proxy identifier |
| api_proxy_name | API Proxy name |
| proxy_method_id | Method identifier |
| proxy_method_name | Method name |
| username_or_key | Username or API key |
| status_code | HTTP response code |
| result_type | Operation result |
| error_type | Error type |
| from_client_ro_header | Headers received from the client (JSON) |
| from_client_ro_param | Query parameters received from the client (JSON) |
| from_client_ro_body | Request body received from the client |
| capture_region | Pipeline stage in which the policy ran: FROM_CLIENT, TO_BACKEND, FROM_BACKEND, TO_CLIENT |
| capture_location | Level at which the policy is defined: API_PROXY_GROUP (Group), API_PROXY (Proxy), API_PROXY_METHOD (Method) |
Recommended Indexes
When the logging policy is placed at more than one point in the pipeline (for example FROM_CLIENT and TO_CLIENT), the request and response records share the same correlation_id. For this reason the correlation_id index is critical for joining request and response end to end.
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
CREATE INDEX idx_policycapture_correlation ON log_PolicyCapture(correlation_id);
CREATE INDEX idx_policycapture_timestamp ON log_PolicyCapture(log_timestamp);
CREATE INDEX idx_policycapture_proxy ON log_PolicyCapture(api_proxy_id);
CREATE INDEX idx_policycapture_region ON log_PolicyCapture(capture_region);
CREATE INDEX idx_policycapture_correlation ON log_PolicyCapture(correlation_id);
CREATE INDEX idx_policycapture_timestamp ON log_PolicyCapture(log_timestamp);
CREATE INDEX idx_policycapture_proxy ON log_PolicyCapture(api_proxy_id);
CREATE INDEX idx_policycapture_region ON log_PolicyCapture(capture_region);
CREATE INDEX idx_policycapture_correlation ON log_PolicyCapture(correlation_id);
CREATE INDEX idx_policycapture_timestamp ON log_PolicyCapture(log_timestamp);
CREATE INDEX idx_policycapture_proxy ON log_PolicyCapture(api_proxy_id);
CREATE INDEX idx_policycapture_region ON log_PolicyCapture(capture_region);
CREATE INDEX idx_policycapture_correlation ON log_PolicyCapture(correlation_id);
CREATE INDEX idx_policycapture_timestamp ON log_PolicyCapture(log_timestamp);
CREATE INDEX idx_policycapture_proxy ON log_PolicyCapture(api_proxy_id);
CREATE INDEX idx_policycapture_region ON log_PolicyCapture(capture_region);
Partitioning
Volume depends on the number of logging policies attached to the flows and how often they are triggered. For policies attached at proxy/method level on high-traffic APIs, daily partitioning on log_timestamp is recommended. See Partition Syntax.
Elasticsearch Integration
If you use an Elasticsearch connector, a separate index template must be created for log policy data. This template differs from the standard API traffic log template and contains only the fields sent by the log policy.
The Elasticsearch index template and ILM policy for log policy data are not automatically created from the Apinizer UI. You need to manually apply the following steps on Elasticsearch.
Step 1: Create ILM Policy
Create an ILM policy for index lifecycle management. The following example creates a policy that rolls over at 30 GB or 1 day and deletes after 30 days. Adjust the values according to your needs.
PUT _ilm/policy/apinizer-log-policy-capture-ilm
{
"policy": {
"phases": {
"hot": {
"actions": {
"rollover": {
"max_size": "30gb",
"max_age": "1d"
}
}
},
"delete": {
"min_age": "30d",
"actions": {
"delete": {}
}
}
}
}
}
Step 2: Create Index Template
Run the following command using Elasticsearch Kibana Dev Tools or curl. The template includes data stream support.
The field types in the template must exactly match the JSON structure sent by the log policy. Do not change field types.
PUT _index_template/apinizer-log-policy-capture-template
{
"index_patterns": ["apinizer-log-policy-capture*"],
"data_stream": {},
"template": {
"settings": {
"index": {
"lifecycle": {
"name": "apinizer-log-policy-capture-ilm"
},
"number_of_shards": 1,
"number_of_replicas": 0,
"refresh_interval": "5s"
}
},
"mappings": {
"properties": {
"@timestamp": {
"type": "date",
"format": "yyyy-MM-dd'T'HH:mm:ss.S'Z'||yyyy-MM-dd'T'HH:mm:ss.SS'Z'||yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"
},
"aci": {
"type": "keyword"
},
"ei": {
"type": "keyword"
},
"api": {
"type": "keyword"
},
"apn": {
"type": "keyword"
},
"apmi": {
"type": "keyword"
},
"apmn": {
"type": "keyword"
},
"uok": {
"type": "keyword",
"ignore_above": 50
},
"sc": {
"type": "short"
},
"rt": {
"type": "keyword",
"ignore_above": 7
},
"et": {
"type": "keyword",
"ignore_above": 75
},
"fcrh": {
"type": "nested",
"properties": {
"k": {
"type": "keyword"
},
"v": {
"type": "keyword"
}
}
},
"fcrp": {
"type": "nested",
"properties": {
"k": {
"type": "keyword"
},
"v": {
"type": "keyword"
}
}
},
"fcrb": {
"type": "text"
},
"cr": {
"type": "keyword"
},
"cl": {
"type": "keyword"
}
}
}
}
}
Step 3: Create Data Stream
After the template is created, the data stream is created automatically when the first data arrives. To create it manually:
PUT _data_stream/apinizer-log-policy-capture
Enter apinizer-log-policy-capture in the Elasticsearch connector's Index Name field. This name must match the index_patterns in the template. If you want to use a different index name, update the index_patterns field in the template accordingly.
Application Log
This is the table that stores Apinizer platform-level application logs.
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
CREATE TABLE log_Application (
id VARCHAR2(255) PRIMARY KEY,
env_name VARCHAR2(255),
api_proxy_id VARCHAR2(255),
api_proxy_name VARCHAR2(255),
correlation_id VARCHAR2(255),
log_timestamp TIMESTAMP,
log_level VARCHAR2(255),
message CLOB,
stack_trace CLOB,
host_name VARCHAR2(255),
enum_application_log VARCHAR2(255),
total_duration NUMBER(10)
);
CREATE TABLE log_Application (
id VARCHAR(255) PRIMARY KEY,
env_name VARCHAR(255),
api_proxy_id VARCHAR(255),
api_proxy_name VARCHAR(255),
correlation_id VARCHAR(255),
log_timestamp TIMESTAMP NULL,
log_level VARCHAR(255),
message TEXT,
stack_trace TEXT,
host_name VARCHAR(255),
enum_application_log VARCHAR(255),
total_duration INT
);
CREATE TABLE log_Application (
id VARCHAR(255) PRIMARY KEY,
env_name VARCHAR(255),
api_proxy_id VARCHAR(255),
api_proxy_name VARCHAR(255),
correlation_id VARCHAR(255),
log_timestamp TIMESTAMP,
log_level VARCHAR(255),
message TEXT,
stack_trace TEXT,
host_name VARCHAR(255),
enum_application_log VARCHAR(255),
total_duration INTEGER
);
CREATE TABLE log_Application (
id NVARCHAR(255) PRIMARY KEY,
env_name NVARCHAR(255),
api_proxy_id NVARCHAR(255),
api_proxy_name NVARCHAR(255),
correlation_id NVARCHAR(255),
log_timestamp DATETIME2,
log_level NVARCHAR(255),
message NVARCHAR(MAX),
stack_trace NVARCHAR(MAX),
host_name NVARCHAR(255),
enum_application_log NVARCHAR(255),
total_duration INT
);
| Column | Description |
|---|---|
| id | Record identifier |
| env_name | Environment name |
| api_proxy_id | API Proxy identifier |
| api_proxy_name | API Proxy name |
| correlation_id | Correlation identifier |
| log_timestamp | Time the log record was created |
| log_level | Log level (INFO, WARN, ERROR, etc.) |
| message | Log message |
| stack_trace | Error stack trace |
| host_name | Name of the server where the log originated |
| enum_application_log | Application log source type |
| total_duration | Total processing time (ms) |
Recommended Indexes
Application logs are mostly filtered by time range and log level (for troubleshooting); they are also joined with traffic logs on correlation_id to reconstruct the platform-level events of a single request.
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
CREATE INDEX idx_application_correlation ON log_Application(correlation_id);
CREATE INDEX idx_application_timestamp ON log_Application(log_timestamp);
CREATE INDEX idx_application_level ON log_Application(log_level);
CREATE INDEX idx_application_proxy ON log_Application(api_proxy_id);
CREATE INDEX idx_application_correlation ON log_Application(correlation_id);
CREATE INDEX idx_application_timestamp ON log_Application(log_timestamp);
CREATE INDEX idx_application_level ON log_Application(log_level);
CREATE INDEX idx_application_proxy ON log_Application(api_proxy_id);
CREATE INDEX idx_application_correlation ON log_Application(correlation_id);
CREATE INDEX idx_application_timestamp ON log_Application(log_timestamp);
CREATE INDEX idx_application_level ON log_Application(log_level);
CREATE INDEX idx_application_proxy ON log_Application(api_proxy_id);
CREATE INDEX idx_application_correlation ON log_Application(correlation_id);
CREATE INDEX idx_application_timestamp ON log_Application(log_timestamp);
CREATE INDEX idx_application_level ON log_Application(log_level);
CREATE INDEX idx_application_proxy ON log_Application(api_proxy_id);
Partitioning
Application logs accumulate steadily. On live systems, daily partitioning on log_timestamp is recommended. See Partition Syntax.
Audit Event
This is the table that stores the audit trail of user operations.
The CREATE TABLE command below is intended for new installations and already includes the request-context columns (event type, outcome, client IP, user agent, correlation id, source).
If you are upgrading an existing installation, do not run this command; your table already exists. Run the 2026.09.2 — Audit and Login Table ALTER Scripts script once — unlike the traffic-log ALTER scripts above, this one is not optional to defer: the insert statement is unconditional, so until the script is run, every Audit Event row bound for this table fails to write.
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
CREATE TABLE log_AuditEvent (
id VARCHAR2(255) PRIMARY KEY,
audit_event_date TIMESTAMP,
principal VARCHAR2(255),
state VARCHAR2(255),
object_id VARCHAR2(255),
object_name VARCHAR2(255),
ref_object_json CLOB,
project_id VARCHAR2(255),
class_name VARCHAR2(255),
event_type VARCHAR2(32),
outcome VARCHAR2(16),
client_ip VARCHAR2(64),
user_agent VARCHAR2(512),
correlation_id VARCHAR2(255),
source VARCHAR2(32)
);
CREATE TABLE log_AuditEvent (
id VARCHAR(255) PRIMARY KEY,
audit_event_date TIMESTAMP NULL,
principal VARCHAR(255),
state VARCHAR(255),
object_id VARCHAR(255),
object_name VARCHAR(255),
ref_object_json LONGTEXT,
project_id VARCHAR(255),
class_name VARCHAR(255),
event_type VARCHAR(32),
outcome VARCHAR(16),
client_ip VARCHAR(64),
user_agent VARCHAR(512),
correlation_id VARCHAR(255),
source VARCHAR(32)
);
CREATE TABLE log_AuditEvent (
id VARCHAR(255) PRIMARY KEY,
audit_event_date TIMESTAMP,
principal VARCHAR(255),
state VARCHAR(255),
object_id VARCHAR(255),
object_name VARCHAR(255),
ref_object_json TEXT,
project_id VARCHAR(255),
class_name VARCHAR(255),
event_type VARCHAR(32),
outcome VARCHAR(16),
client_ip VARCHAR(64),
user_agent VARCHAR(512),
correlation_id VARCHAR(255),
source VARCHAR(32)
);
CREATE TABLE log_AuditEvent (
id NVARCHAR(255) PRIMARY KEY,
audit_event_date DATETIME2,
principal NVARCHAR(255),
state NVARCHAR(255),
object_id NVARCHAR(255),
object_name NVARCHAR(255),
ref_object_json NVARCHAR(MAX),
project_id NVARCHAR(255),
class_name NVARCHAR(255),
event_type NVARCHAR(32),
outcome NVARCHAR(16),
client_ip NVARCHAR(64),
user_agent NVARCHAR(512),
correlation_id NVARCHAR(255),
source NVARCHAR(32)
);
| Column | Description |
|---|---|
| id | Record identifier |
| audit_event_date | Time the audit event occurred |
| principal | User who performed the operation |
| state | State of the operation (CREATE, UPDATE, DELETE, etc.) |
| object_id | Identifier of the object operated on |
| object_name | Name of the object operated on |
| ref_object_json | JSON representation of the object operated on |
| project_id | Project identifier |
| class_name | Type of the object |
| event_type | Which of the Audit Records event types this row is |
| outcome | Result of the operation — SUCCESS, FAILURE, or DENIED |
| client_ip | The client's real IP address (read from X-Forwarded-For when present) |
| user_agent | The User-Agent header sent by the client |
| correlation_id | Ties this record to the request's other log entries |
| source | The front door the request came from — Management Console, APIops, API Portal, or System |
Recommended Indexes
Audit queries are most often filtered by date range, user (principal), affected object type, or project. Note that here the partition key is audit_event_date, not log_timestamp.
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
CREATE INDEX idx_auditevent_date ON log_AuditEvent(audit_event_date);
CREATE INDEX idx_auditevent_principal ON log_AuditEvent(principal);
CREATE INDEX idx_auditevent_project ON log_AuditEvent(project_id);
CREATE INDEX idx_auditevent_class ON log_AuditEvent(class_name);
CREATE INDEX idx_auditevent_state ON log_AuditEvent(state);
CREATE INDEX idx_auditevent_correlation ON log_AuditEvent(correlation_id);
CREATE INDEX idx_auditevent_source ON log_AuditEvent(source);
CREATE INDEX idx_auditevent_date ON log_AuditEvent(audit_event_date);
CREATE INDEX idx_auditevent_principal ON log_AuditEvent(principal);
CREATE INDEX idx_auditevent_project ON log_AuditEvent(project_id);
CREATE INDEX idx_auditevent_class ON log_AuditEvent(class_name);
CREATE INDEX idx_auditevent_state ON log_AuditEvent(state);
CREATE INDEX idx_auditevent_correlation ON log_AuditEvent(correlation_id);
CREATE INDEX idx_auditevent_source ON log_AuditEvent(source);
CREATE INDEX idx_auditevent_date ON log_AuditEvent(audit_event_date);
CREATE INDEX idx_auditevent_principal ON log_AuditEvent(principal);
CREATE INDEX idx_auditevent_project ON log_AuditEvent(project_id);
CREATE INDEX idx_auditevent_class ON log_AuditEvent(class_name);
CREATE INDEX idx_auditevent_state ON log_AuditEvent(state);
CREATE INDEX idx_auditevent_correlation ON log_AuditEvent(correlation_id);
CREATE INDEX idx_auditevent_source ON log_AuditEvent(source);
CREATE INDEX idx_auditevent_date ON log_AuditEvent(audit_event_date);
CREATE INDEX idx_auditevent_principal ON log_AuditEvent(principal);
CREATE INDEX idx_auditevent_project ON log_AuditEvent(project_id);
CREATE INDEX idx_auditevent_class ON log_AuditEvent(class_name);
CREATE INDEX idx_auditevent_state ON log_AuditEvent(state);
CREATE INDEX idx_auditevent_correlation ON log_AuditEvent(correlation_id);
CREATE INDEX idx_auditevent_source ON log_AuditEvent(source);
Partitioning
Audit events are produced by user operations (far fewer than traffic records) and are usually retained longer for compliance reasons. Monthly partitioning on audit_event_date is generally sufficient. In the Partition Syntax section, you can use MONTH instead of DAY.
Login Log
The table that records login attempts (both success and failure events) to the API Manager and API Portal.
The CREATE TABLE command below is intended for new installations and already includes the request-context columns (user agent, reason, target project).
If you are upgrading an existing installation, do not run this command; your table already exists. Run the 2026.09.2 — Audit and Login Table ALTER Scripts script once — the insert statement is unconditional, so until the script is run, every Login Log row bound for this table fails to write, and — unlike Audit Event above — that row is not retried through a failover connector; it is simply lost.
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
CREATE TABLE log_LoginLog (
id VARCHAR2(255) PRIMARY KEY,
log_timestamp TIMESTAMP,
source VARCHAR2(50),
principal VARCHAR2(255),
email VARCHAR2(255),
display_name VARCHAR2(255),
event_type VARCHAR2(50),
remote_address VARCHAR2(255),
message CLOB,
error_type VARCHAR2(255),
portal_id VARCHAR2(255),
account_id VARCHAR2(255),
user_agent VARCHAR2(512),
reason_code VARCHAR2(64),
target_project_id VARCHAR2(255)
);
CREATE TABLE log_LoginLog (
id VARCHAR(255) PRIMARY KEY,
log_timestamp TIMESTAMP NULL,
source VARCHAR(50),
principal VARCHAR(255),
email VARCHAR(255),
display_name VARCHAR(255),
event_type VARCHAR(50),
remote_address VARCHAR(255),
message TEXT,
error_type VARCHAR(255),
portal_id VARCHAR(255),
account_id VARCHAR(255),
user_agent VARCHAR(512),
reason_code VARCHAR(64),
target_project_id VARCHAR(255)
);
CREATE TABLE log_LoginLog (
id VARCHAR(255) PRIMARY KEY,
log_timestamp TIMESTAMP,
source VARCHAR(50),
principal VARCHAR(255),
email VARCHAR(255),
display_name VARCHAR(255),
event_type VARCHAR(50),
remote_address VARCHAR(255),
message TEXT,
error_type VARCHAR(255),
portal_id VARCHAR(255),
account_id VARCHAR(255),
user_agent VARCHAR(512),
reason_code VARCHAR(64),
target_project_id VARCHAR(255)
);
CREATE TABLE log_LoginLog (
id NVARCHAR(255) PRIMARY KEY,
log_timestamp DATETIME2,
source NVARCHAR(50),
principal NVARCHAR(255),
email NVARCHAR(255),
display_name NVARCHAR(255),
event_type NVARCHAR(50),
remote_address NVARCHAR(255),
message NVARCHAR(MAX),
error_type NVARCHAR(255),
portal_id NVARCHAR(255),
account_id NVARCHAR(255),
user_agent NVARCHAR(512),
reason_code NVARCHAR(64),
target_project_id NVARCHAR(255)
);
| Column | Description |
|---|---|
| id | Record identifier |
| log_timestamp | Time the login event occurred |
| source | Login source (API_MANAGER, API_PORTAL) |
| principal | User principal (API Manager login) |
| User email (API Portal login) | |
| display_name | User display name |
| event_type | Event type (LOGIN_SUCCESS, LOGIN_FAILURE) |
| remote_address | Client remote IP address |
| message | Result message or failure reason |
| error_type | Error class (for failed logins) |
| portal_id | Portal identifier (for portal logins) |
| account_id | Account identifier (for portal logins) |
| user_agent | The User-Agent header sent by the client |
| reason_code | The machine-readable reason behind a failure, lock, or password event |
| target_project_id | The project the session moved to, for a project-switch (token refresh) event |
Recommended Indexes
Login logs are queried by time range, user (email/principal), login source, and event type (for security auditing and locked-account investigation).
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
CREATE INDEX idx_loginlog_timestamp ON log_LoginLog(log_timestamp);
CREATE INDEX idx_loginlog_email ON log_LoginLog(email);
CREATE INDEX idx_loginlog_principal ON log_LoginLog(principal);
CREATE INDEX idx_loginlog_source ON log_LoginLog(source);
CREATE INDEX idx_loginlog_event ON log_LoginLog(event_type);
CREATE INDEX idx_loginlog_timestamp ON log_LoginLog(log_timestamp);
CREATE INDEX idx_loginlog_email ON log_LoginLog(email);
CREATE INDEX idx_loginlog_principal ON log_LoginLog(principal);
CREATE INDEX idx_loginlog_source ON log_LoginLog(source);
CREATE INDEX idx_loginlog_event ON log_LoginLog(event_type);
CREATE INDEX idx_loginlog_timestamp ON log_LoginLog(log_timestamp);
CREATE INDEX idx_loginlog_email ON log_LoginLog(email);
CREATE INDEX idx_loginlog_principal ON log_LoginLog(principal);
CREATE INDEX idx_loginlog_source ON log_LoginLog(source);
CREATE INDEX idx_loginlog_event ON log_LoginLog(event_type);
CREATE INDEX idx_loginlog_timestamp ON log_LoginLog(log_timestamp);
CREATE INDEX idx_loginlog_email ON log_LoginLog(email);
CREATE INDEX idx_loginlog_principal ON log_LoginLog(principal);
CREATE INDEX idx_loginlog_source ON log_LoginLog(source);
CREATE INDEX idx_loginlog_event ON log_LoginLog(event_type);
Partitioning
Login log volume is typically low compared to traffic logs. For the long retention periods often required for security auditing, monthly partitioning on log_timestamp is sufficient. See the Partition Syntax section for examples, and use MONTH instead of DAY for the interval.
Unsent Message
This is the table that temporarily stores log records that could not be delivered due to a connection failure.
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
CREATE TABLE log_UnsentMessage (
id VARCHAR2(255) PRIMARY KEY,
log_timestamp TIMESTAMP,
connector_id VARCHAR2(50),
content CLOB
);
CREATE TABLE log_UnsentMessage (
id VARCHAR(255) PRIMARY KEY,
log_timestamp TIMESTAMP NULL,
connector_id VARCHAR(50),
content LONGTEXT
);
CREATE TABLE log_UnsentMessage (
id VARCHAR(255) PRIMARY KEY,
log_timestamp TIMESTAMP,
connector_id VARCHAR(50),
content TEXT
);
CREATE TABLE log_UnsentMessage (
id NVARCHAR(255) PRIMARY KEY,
log_timestamp DATETIME2,
connector_id NVARCHAR(50),
content NVARCHAR(MAX)
);
| Column | Description |
|---|---|
| id | Record identifier |
| log_timestamp | Time the record was created |
| connector_id | Identifier of the connector the data was attempted to be sent to |
| content | Content of the undelivered log record (JSON) |
Recommended Indexes
Records in this table are transient: they are inserted when a connector is unreachable and deleted once delivery succeeds. A small number of indexes is enough for retry lookups and cleanup.
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
CREATE INDEX idx_unsent_timestamp ON log_UnsentMessage(log_timestamp);
CREATE INDEX idx_unsent_connector ON log_UnsentMessage(connector_id);
CREATE INDEX idx_unsent_timestamp ON log_UnsentMessage(log_timestamp);
CREATE INDEX idx_unsent_connector ON log_UnsentMessage(connector_id);
CREATE INDEX idx_unsent_timestamp ON log_UnsentMessage(log_timestamp);
CREATE INDEX idx_unsent_connector ON log_UnsentMessage(connector_id);
CREATE INDEX idx_unsent_timestamp ON log_UnsentMessage(log_timestamp);
CREATE INDEX idx_unsent_connector ON log_UnsentMessage(connector_id);
Partitioning
This table holds transient records that are consumed within a short time window. Partitioning is not required. If the table grows unexpectedly (long outages), operational cleanup is a more appropriate solution than partitioning. Partitioning is possible and does not affect Apinizer's INSERT behavior, but for this temporary queue table operational cleanup is usually sufficient.
Partition Syntax
The examples below use daily partitioning on log_timestamp. Change the table name and the initial boundary date to suit your environment. For the log_AuditEvent table, use the audit_event_date column instead of log_timestamp, and prefer a monthly interval instead of a daily one.
- Oracle
- MySQL/MariaDB
- PostgreSQL
- SQL Server
-- Apply during CREATE TABLE (after the column list):
)
PARTITION BY RANGE (log_timestamp)
INTERVAL (NUMTODSINTERVAL(1, 'DAY'))
(
PARTITION p_initial VALUES LESS THAN (TIMESTAMP '2026-01-01 00:00:00')
);
-- Monthly variant (for example, for log_AuditEvent):
-- INTERVAL (NUMTOYMINTERVAL(1, 'MONTH'))
-- The partition key must be part of the PRIMARY KEY.
-- Adjust the primary key in the table definition as follows:
-- PRIMARY KEY (id, log_timestamp)
ALTER TABLE log_ApiProxyTraffic
PARTITION BY RANGE (TO_DAYS(log_timestamp)) (
PARTITION p_initial VALUES LESS THAN (TO_DAYS('2026-01-01')),
PARTITION p_future VALUES LESS THAN MAXVALUE
);
-- Add new daily partitions in advance with a scheduled job:
ALTER TABLE log_ApiProxyTraffic REORGANIZE PARTITION p_future INTO (
PARTITION p20260421 VALUES LESS THAN (TO_DAYS('2026-04-22')),
PARTITION p_future VALUES LESS THAN MAXVALUE
);
-- Update the table definition during CREATE TABLE as follows:
CREATE TABLE log_ApiProxyTraffic (
/* ... columns ... */
) PARTITION BY RANGE (log_timestamp);
-- Create a child table for each day (scheduled job):
CREATE TABLE log_ApiProxyTraffic_p20260421
PARTITION OF log_ApiProxyTraffic
FOR VALUES FROM ('2026-04-21') TO ('2026-04-22');
-- Drop an old partition quickly:
DROP TABLE log_ApiProxyTraffic_p20260101;
-- 0) Prerequisite: N boundary values produce N+1 partitions; the scheme must list exactly
-- one filegroup per partition. Enterprise deployments may use yearly filegroups; in the
-- minimal example all partitions map to [PRIMARY].
-- 1) Partition function (daily boundaries):
CREATE PARTITION FUNCTION pf_logs_daily (DATETIME2)
AS RANGE RIGHT FOR VALUES ('2026-01-01', '2026-01-02', '2026-01-03');
-- 2) Partition scheme:
CREATE PARTITION SCHEME ps_logs_daily
AS PARTITION pf_logs_daily ALL TO ([PRIMARY]);
-- 3) Create the table WITHOUT an inline PK (same column list as above):
CREATE TABLE log_ApiProxyTraffic (
id NVARCHAR(255) NOT NULL,
log_timestamp DATETIME2 NOT NULL,
/* ... other columns ... */
) ON ps_logs_daily(log_timestamp);
GO
-- 4) A clustered PK cannot exclude the partition column — use an NC PK + CI on the partition column:
ALTER TABLE log_ApiProxyTraffic
ADD CONSTRAINT PK_log_ApiProxyTraffic_id
PRIMARY KEY NONCLUSTERED (id)
ON [PRIMARY];
GO
CREATE CLUSTERED INDEX IX_log_ApiProxyTraffic_Partitioning
ON log_ApiProxyTraffic (log_timestamp)
ON ps_logs_daily(log_timestamp);
GO
-- 5) Recommended nonclustered indexes (aligned with the partition scheme):
CREATE INDEX idx_apitraffic_correlation ON log_ApiProxyTraffic(correlation_id)
ON ps_logs_daily(log_timestamp);
CREATE INDEX idx_apitraffic_proxy ON log_ApiProxyTraffic(api_proxy_id)
ON ps_logs_daily(log_timestamp);
CREATE INDEX idx_apitraffic_project ON log_ApiProxyTraffic(project_id)
ON ps_logs_daily(log_timestamp);
CREATE INDEX idx_apitraffic_status ON log_ApiProxyTraffic(status_code)
ON ps_logs_daily(log_timestamp);
CREATE INDEX idx_apitraffic_result ON log_ApiProxyTraffic(result_type)
ON ps_logs_daily(log_timestamp);
-- 6) Extending the boundaries with a scheduled job:
ALTER PARTITION SCHEME ps_logs_daily NEXT USED [PRIMARY];
ALTER PARTITION FUNCTION pf_logs_daily() SPLIT RANGE ('2026-04-22');
In SQL Server, if the table uses a partition scheme keyed on log_timestamp or audit_event_date, you cannot define a clustered PRIMARY KEY on id (Msg 1908). The clustered index must be on the partition column; use a NONCLUSTERED PK for id. Yearly filegroups or quarterly partitions are valid operational choices and do not change Apinizer's INSERT behavior.
New daily partitions must be created in advance (for example with a scheduled job). If the target partition does not exist when a record arrives, the insert fails on SQL Server and MySQL; on Oracle it is created automatically only when INTERVAL partitioning is used.
Data Type Mapping Table
The table below shows the data type mappings across the different databases.
| Usage | Oracle | MySQL/MariaDB | PostgreSQL | SQL Server |
|---|---|---|---|---|
| Short text | VARCHAR2(255) | VARCHAR(255) | VARCHAR(255) | NVARCHAR(255) |
| Long text | CLOB | TEXT / LONGTEXT | TEXT | NVARCHAR(MAX) |
| Integer | NUMBER(10) | INT | INTEGER | INT |
| Big integer | NUMBER(19) | BIGINT | BIGINT | BIGINT |
| Decimal number | NUMBER | DOUBLE | DOUBLE PRECISION | FLOAT |
| Boolean | NUMBER(1) | TINYINT(1) | BOOLEAN | BIT |
| Date/Time | TIMESTAMP | TIMESTAMP NULL | TIMESTAMP | DATETIME2 |